What capacity does radtest have to display custom attributes
I’ve been experimenting with the server, trying to get it to return arbitrary custom attributes (defined in dictionary.local) to the Radius-reply. When I run radtest against the virtual-server I see the attributes being added and mentioned in the post-auth debug, but I never see the attribute on the client side of the radtest. Is radtest limited to only displaying officially defined attributes, or might I be doing something obviously ridiculous? Radius Debug ~~~ 0) Sending Access-Accept packet to host 192.0.2.90 port 36843, id=194, length=0 (0) Entitlement := 'vpn-library' (0) Juniper-Ip-Pool-Name := 'vpn-library' Sending Access-Accept Id 194 from 192.0.2.53:1828 to 192.0.2.90:36843 Juniper-Ip-Pool-Name := 'vpn-library’ Radtest Output ~~~ Sending Access-Request Id 194 from 0.0.0.0:36843 to 192.0.2.53:1828 User-Name = ‘glados' User-Password = ‘ilovecake' NAS-IP-Address = 192.0.2.90 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 194 from 192.0.2.53:1828 to 192.0.2.90:36843 length 39 Juniper-Ip-Pool-Name = 'vpn-library' ======================= Mark Williams markhw@vt.edu (2A83CAC8)
dictionary.local ~~~ … ATTRIBUTE Entitlement 3003 string … sites-enabled/default ~~~ … update reply{ Entitlement := "vpn-remote-access" Juniper-Ip-Pool-Name := "vpn-remote-access" } ... ======================= Mark Williams markhw@vt.edu (2A83CAC8)
On Jul 11, 2017, at 2:48 PM, Mark Williams <markhw@vt.edu> wrote:
I’ve been experimenting with the server, trying to get it to return arbitrary custom attributes (defined in dictionary.local) to the Radius-reply. When I run radtest against the virtual-server I see the attributes being added and mentioned in the post-auth debug, but I never see the attribute on the client side of the radtest. Is radtest limited to only displaying officially defined attributes, or might I be doing something obviously ridiculous?
Radius Debug ~~~ 0) Sending Access-Accept packet to host 192.0.2.90 port 36843, id=194, length=0 (0) Entitlement := 'vpn-library' (0) Juniper-Ip-Pool-Name := 'vpn-library' Sending Access-Accept Id 194 from 192.0.2.53:1828 to 192.0.2.90:36843 Juniper-Ip-Pool-Name := 'vpn-library’
Radtest Output ~~~ Sending Access-Request Id 194 from 0.0.0.0:36843 to 192.0.2.53:1828 User-Name = ‘glados' User-Password = ‘ilovecake' NAS-IP-Address = 192.0.2.90 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 194 from 192.0.2.53:1828 to 192.0.2.90:36843 length 39 Juniper-Ip-Pool-Name = 'vpn-library'
======================= Mark Williams markhw@vt.edu (2A83CAC8)
On Tue, 2017-07-11 at 14:52 -0400, Mark Williams wrote:
dictionary.local ~~~ … ATTRIBUTE Entitlement 3003 string
As described in the raddb/dictionary file, 3003 is a local attribute and will therefore never go in a RADIUS packet. Use an attribute in the correct range and it'll work. -- Matthew
On Jul 11, 2017, at 2:48 PM, Mark Williams <markhw@vt.edu> wrote:
I’ve been experimenting with the server, trying to get it to return arbitrary custom attributes (defined in dictionary.local) to the Radius-reply.
And what is the definition of those attributes? That would help...
When I run radtest against the virtual-server I see the attributes being added and mentioned in the post-auth debug, but I never see the attribute on the client side of the radtest. Is radtest limited to only displaying officially defined attributes, or might I be doing something obviously ridiculous?
The RADIUS protocol can only transport attributes which are number 1..255, or VSAs. The comments in raddb/dictioanry explain this. Note that just putting the attributes into dictionary.local isn't good enough. You will probably need to define a VSA. See share/dictionary.* for examples of defining vendor-specific dictionaries. You will need a private enterprise number. Happily, vt.edu already has one: 1446. So define your own vendor space there, and know that you're not interfering with anyone else. :) Alan DeKok.
I do remember reading something about that in the comments. Since I was seeing (it appeared) values being added in the debug, I thought that maybe custom attributes could be handed back, but wouldn’t be added automatically. Alright. I’ll take the VSA route! Thanks! ======================= Mark Williams markhw@vt.edu (2A83CAC8)
On Jul 11, 2017, at 2:59 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 11, 2017, at 2:48 PM, Mark Williams <markhw@vt.edu> wrote:
I’ve been experimenting with the server, trying to get it to return arbitrary custom attributes (defined in dictionary.local) to the Radius-reply.
And what is the definition of those attributes? That would help...
When I run radtest against the virtual-server I see the attributes being added and mentioned in the post-auth debug, but I never see the attribute on the client side of the radtest. Is radtest limited to only displaying officially defined attributes, or might I be doing something obviously ridiculous?
The RADIUS protocol can only transport attributes which are number 1..255, or VSAs. The comments in raddb/dictioanry explain this.
Note that just putting the attributes into dictionary.local isn't good enough. You will probably need to define a VSA. See share/dictionary.* for examples of defining vendor-specific dictionaries.
You will need a private enterprise number. Happily, vt.edu already has one: 1446. So define your own vendor space there, and know that you're not interfering with anyone else. :)
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Mark Williams -
Matthew Newton